diff -pruN net-2.6.orig/net/netfilter/Kconfig net-2.6.fixed/net/netfilter/Kconfig
--- net-2.6.orig/net/netfilter/Kconfig	2008-01-30 20:17:08.000000000 +0200
+++ net-2.6.fixed/net/netfilter/Kconfig	2008-02-02 14:37:22.000000000 +0200
@@ -375,6 +375,12 @@ config NETFILTER_XT_TARGET_NOTRACK
 	  If you want to compile it as a module, say M here and read
 	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 
+config NETFILTER_XT_TARGET_NOTRACK_NEW
+	bool "NOTRACK safe (only new)"
+	depends on NETFILTER_XT_TARGET_NOTRACK
+	help
+	  Slow but safe way to NOTRACK only new/untracked connections.
+
 config NETFILTER_XT_TARGET_RATEEST
 	tristate '"RATEEST" target support'
 	depends on NETFILTER_XTABLES
diff -pruN net-2.6.orig/net/netfilter/nf_conntrack_core.c net-2.6.fixed/net/netfilter/nf_conntrack_core.c
--- net-2.6.orig/net/netfilter/nf_conntrack_core.c	2008-01-30 20:17:08.000000000 +0200
+++ net-2.6.fixed/net/netfilter/nf_conntrack_core.c	2008-02-02 14:22:53.000000000 +0200
@@ -587,6 +587,9 @@ resolve_normal_ct(struct sk_buff *skb,
 	struct nf_conntrack_tuple tuple;
 	struct nf_conntrack_tuple_hash *h;
 	struct nf_conn *ct;
+#ifdef CONFIG_NETFILTER_XT_TARGET_NOTRACK_NEW
+	struct nf_conntrack_expect *exp;
+#endif
 
 	if (!nf_ct_get_tuple(skb, skb_network_offset(skb),
 			     dataoff, l3num, protonum, &tuple, l3proto,
@@ -598,6 +601,17 @@ resolve_normal_ct(struct sk_buff *skb,
 	/* look for tuple match */
 	h = nf_conntrack_find_get(&tuple);
 	if (!h) {
+#ifdef CONFIG_NETFILTER_XT_TARGET_NOTRACK_NEW
+		if(skb->nfctinfo == IP_CT_NEW) {
+		    exp = nf_ct_expect_find_get(&tuple);
+		    if(!exp){
+			skb->nfct = &nf_conntrack_untracked.ct_general;
+			nf_conntrack_get(skb->nfct);
+			return NULL;
+		    }
+		    nf_ct_expect_put(exp);
+		}
+#endif
 		h = init_conntrack(&tuple, l3proto, l4proto, skb, dataoff);
 		if (!h)
 			return NULL;
@@ -675,6 +689,12 @@ nf_conntrack_in(int pf, unsigned int hoo
 	ct = resolve_normal_ct(skb, dataoff, pf, protonum, l3proto, l4proto,
 			       &set_reply, &ctinfo);
 	if (!ct) {
+#ifdef CONFIG_NETFILTER_XT_TARGET_NOTRACK_NEW
+		if(skb->nfct == &nf_conntrack_untracked.ct_general){
+		    NF_CT_STAT_INC_ATOMIC(ignore);
+		    return NF_ACCEPT;
+		}
+#endif
 		/* Not valid part of a connection */
 		NF_CT_STAT_INC_ATOMIC(invalid);
 		return NF_ACCEPT;
diff -pruN net-2.6.orig/net/netfilter/xt_NOTRACK.c net-2.6.fixed/net/netfilter/xt_NOTRACK.c
--- net-2.6.orig/net/netfilter/xt_NOTRACK.c	2008-01-30 20:17:08.000000000 +0200
+++ net-2.6.fixed/net/netfilter/xt_NOTRACK.c	2008-02-02 14:22:02.000000000 +0200
@@ -21,6 +21,9 @@ notrack_tg(struct sk_buff *skb, const st
 	if (skb->nfct != NULL)
 		return XT_CONTINUE;
 
+#ifdef CONFIG_NETFILTER_XT_TARGET_NOTRACK_NEW
+	skb->nfctinfo = IP_CT_NEW;
+#else
 	/* Attach fake conntrack entry.
 	   If there is a real ct entry correspondig to this packet,
 	   it'll hang aroun till timing out. We don't deal with it
@@ -28,6 +31,7 @@ notrack_tg(struct sk_buff *skb, const st
 	skb->nfct = &nf_conntrack_untracked.ct_general;
 	skb->nfctinfo = IP_CT_NEW;
 	nf_conntrack_get(skb->nfct);
+#endif
 
 	return XT_CONTINUE;
 }